Following the end of the Brexit transition period on 31 December 2020, the legal basis for transferring personal data across the Channnel fundamentally changes. Unless the UK receives an adequacy decision from the EU, businesses and other organisations will no longer be able to freely transfer data from the EU to the UK, without putting in place their own additional measures. These measures can be costly, bureaucratic, and time-consuming to implement.
Although the UK has high standards of data protection via the Data Protection Act 2018, which enacted the General Data Protection Regulation (GDPR) in UK law, an EU adequacy decision is not guaranteed. Potential EU concerns with UK national security, surveillance and human rights frameworks, as well as a future trade deal with the US, render adequacy uncertain. Furthermore, EU-UK data flows are at the whim of the wider Brexit process and negotiations.
This landmark report outlines the economic cost and implications of the UK not receiving an adequacy decision from the EU. The authors look at the impact on businesses, different economic sectors, and the wider economy.
Through extensive interviews with over sixty legal professionals, data protection officers, business representatives, and academics, from both the UK and EU, it was found that the risk of the UK failing to secure an adequacy decision is both real and serious, and that the impacts would be complex, leading to significant uncertainty.
1. The government should make relevant data and modelling tools available to support empirical research on the social and economic impacts of data protection, digital trade, and the value of data flows, in order to improve the quality of public policy and democratic engagement in these areas.
2. The government should further explain how the changes to the UK’s data protection regime outlined in the National Data Strategy, designed to promote growth and innovation, will also strengthen and enhance the rights of UK and EU citizens.
3. The government should consider the impact of future trade agreements on data protection, and carefully review the trade-offs involved when liberalising cross-border data flows with different countries.